Skip to content

Commit bdf95c3

Browse files
AmrsatrioAmrsatrio
committed
chore: fix discovered Windows.UI.Xaml.dll, InputSwitch.dll, and CStartExperienceManager vtable pattern issues
1 parent 31d2c23 commit bdf95c3

3 files changed

Lines changed: 104 additions & 46 deletions

File tree

‎ExplorerPatcher/InputSwitch.cpp‎

Lines changed: 66 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -221,19 +221,19 @@ BOOL PatchContextMenuOfNewMicrosoftIME(BOOL* bFound)
221221
"\x44\x38\x00\x00\x74\x00\x00\x8B\xCE\xE8\x00\x00\x00\x00\x85\xC0",
222222
"xx??x??xxx????xx"
223223
);
224-
if (!match)
225-
return FALSE;
226-
227-
DWORD dwOldProtect;
228-
if (!VirtualProtect(match + 4, 1, PAGE_EXECUTE_READWRITE, &dwOldProtect))
229-
return FALSE;
230-
231-
match[4] = 0xEB;
232-
233-
VirtualProtect(match + 4, 1, dwOldProtect, &dwOldProtect);
234-
235-
return TRUE;
224+
if (match)
225+
{
226+
DWORD dwOldProtect;
227+
if (VirtualProtect(match + 4, 1, PAGE_EXECUTE_READWRITE, &dwOldProtect))
228+
{
229+
match[4] = 0xEB;
230+
VirtualProtect(match + 4, 1, dwOldProtect, &dwOldProtect);
231+
return TRUE;
232+
}
233+
}
236234
#elif defined(_M_ARM64)
235+
DWORD newInsn = 0;
236+
237237
// A8 43 40 39 C8 04 00 34 E0 03 ?? AA
238238
// ^^^^^^^^^^^ Change CBZ to B
239239
// Ref: CTsfHandler::_OnOopImeContextMenu()
@@ -243,23 +243,60 @@ BOOL PatchContextMenuOfNewMicrosoftIME(BOOL* bFound)
243243
"\xA8\x43\x40\x39\xC8\x04\x00\x34\xE0\x03\x00\xAA",
244244
"xxxxxxxxxx?x"
245245
);
246-
if (!match)
247-
return FALSE;
248-
249-
match += 4;
250-
251-
DWORD newInsn = ARM64_CBZWToB(*(DWORD*)match);
252-
if (!newInsn)
253-
return FALSE;
254-
255-
DWORD dwOldProtect;
256-
if (!VirtualProtect(match, 4, PAGE_EXECUTE_READWRITE, &dwOldProtect))
257-
return FALSE;
258-
259-
*(DWORD*)match = newInsn;
260-
261-
VirtualProtect(match, 4, dwOldProtect, &dwOldProtect);
246+
if (match)
247+
{
248+
match += 4;
249+
newInsn = ARM64_CBZWToB(*(DWORD*)match);
250+
}
251+
else
252+
{
253+
// GetContextMenuResourceId() inlined
254+
// MOV W19/W20, #15305
255+
// W19: 0b01010010100_0011101111001001_10011 = 52877933 = 33 79 87 52
256+
// W20: 0b01010010100_0011101111001001_10100 = 52877934 = 34 79 87 52
257+
// P: 0b01010010100_0011101111001001_10??? = 52877930 = 30 79 87 52
258+
// M: 0b11111111111_1111111111111111_11000 = FFFFFFF8 = F8 FF FF FF
259+
// Ref: CTsfHandler::_OnOopImeContextMenu()
260+
match = (PBYTE)FindPatternBitMask_4_(
261+
pInputSwitchText,
262+
cbInputSwitchText,
263+
"\x30\x79\x87\x52",
264+
"\xF8\xFF\xFF\xFF",
265+
4
266+
);
267+
if (match)
268+
{
269+
match += 4; // Point to after the mov
270+
271+
// We might be a jmp, follow it if so
272+
PBYTE pJmpTarget = (PBYTE)ARM64_FollowB((DWORD*)match);
273+
if (pJmpTarget)
274+
{
275+
match = pJmpTarget;
276+
}
277+
278+
if (*(DWORD*)match == 0x52800033)
279+
{
280+
newInsn = 0x52800013; // MOV W19, #0
281+
}
282+
else if (*(DWORD*)match == 0x52800034)
283+
{
284+
newInsn = 0x52800014; // MOV W20, #0
285+
}
286+
}
287+
}
262288

263-
return TRUE;
289+
if (newInsn)
290+
{
291+
DWORD dwOldProtect;
292+
if (VirtualProtect(match, 4, PAGE_EXECUTE_READWRITE, &dwOldProtect))
293+
{
294+
*(DWORD*)match = newInsn;
295+
VirtualProtect(match, 4, dwOldProtect, &dwOldProtect);
296+
return TRUE;
297+
}
298+
}
264299
#endif
300+
301+
return FALSE;
265302
}

‎ExplorerPatcher/TwinUIPatches.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1859,17 +1859,17 @@ BOOL FixStartMenuAnimation(HMODULE hTwinuiPcshell, PBYTE pSearchBegin, size_t cb
18591859
matchVtable += 7 + *(int*)(matchVtable + 3);
18601860
}
18611861
#elif defined(_M_ARM64)
1862-
// * Pattern for Nickel
1862+
// * Pattern for Cobalt and Nickel
18631863
// ```
1864-
// 69 A2 03 A9 ?? ?? 00 ?? 08 ?? ?? 91 ?? ?? 00 ?? 29 ?? ?? 91 68 32 00 F9
1864+
// 69 A2 03 A9 ?? ?? 00 ?? 08 ?? ?? 91 ?? ?? 00 ?? 29 ?? ?? 91 ?? 32 00 F9 60 ?? ?? 91 ?? 26 00 F9 ?? ?? ?? ?? 1F 20 03 D5
18651865
// ^^^^^^^^^^^+^^^^^^^^^^^
18661866
// ```
18671867
// Ref: CStartExperienceManager::CStartExperienceManager()
18681868
PBYTE matchVtable = (PBYTE)FindPattern_4_(
18691869
pSearchBegin,
18701870
cbSearch,
1871-
"\x69\xA2\x03\xA9\x00\x00\x00\x00\x08\x00\x00\x91\x00\x00\x00\x00\x29\x00\x00\x91\x68\x32\x00\xF9",
1872-
"xxxx??x?x??x??x?x??xxxxx"
1871+
"\x69\xA2\x03\xA9\x00\x00\x00\x00\x08\x00\x00\x91\x00\x00\x00\x00\x29\x00\x00\x91\x00\x32\x00\xF9\x60\x00\x00\x91\x00\x26\x00\xF9\x00\x00\x00\x00\x1F\x20\x03\xD5",
1872+
"xxxx??x?x??x??x?x??x?xxxx??x?xxx????xxxx"
18731873
);
18741874
if (matchVtable)
18751875
{

‎ExplorerPatcher/dllmain.c‎

Lines changed: 34 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1364,17 +1364,21 @@ void ForceEnableXamlSounds(HMODULE hWindowsUIXaml)
13641364
#elif defined(_M_ARM64)
13651365
// 08 ?? ?? B9 1F 09 00 71 ?? ?? ?? 54 ?? 00 00 35 ?? ?? ?? ??
13661366
// ^^^^^^^^^^^ BL -> MOV W0, #1
1367-
PBYTE match = FindPattern_4_(
1367+
// BL:
1368+
// P: 0b100101_00000000000000000000000000 = 94000000 = 00 00 00 94
1369+
// M: 0b111111_00000000000000000000000000 = FC000000 = 00 00 00 FC
1370+
PBYTE match = FindPatternBitMask_4_(
13681371
pWindowsUIXamlText,
13691372
cbWindowsUIXamlText,
1370-
"\x08\x00\x00\xB9\x1F\x09\x00\x71\x00\x00\x00\x54\x00\x00\x00\x35",
1371-
"x??xxxxx???x?xxx"
1373+
"\x08\x00\x00\xB9\x1F\x09\x00\x71\x00\x00\x00\x54\x00\x00\x00\x35\x00\x00\x00\x94",
1374+
"\xFF\x00\x00\xFF\xFF\xFF\xFF\xFF\x00\x00\x00\xFF\x00\xFF\xFF\xFF\x00\x00\x00\xFC",
1375+
20
13721376
);
13731377
if (match)
13741378
{
13751379
match += 16;
1376-
DWORD currentInsn = *(DWORD*)match;
1377-
DWORD newInsn = ARM64_IsBL(currentInsn) ? 0x52800020 : 0; // MOV W0, #1
1380+
// DWORD currentInsn = *(DWORD*)match;
1381+
DWORD newInsn = /*ARM64_IsBL(currentInsn) ?*/ 0x52800020 /*: 0*/; // MOV W0, #1
13781382
if (newInsn)
13791383
{
13801384
DWORD flOldProtect = 0;
@@ -9931,6 +9935,7 @@ static void PatchAppResolver()
99319935
match += 5 + *(int*)(match + 1);
99329936
}
99339937
#elif defined(_M_ARM64)
9938+
// Nickel+
99349939
// 7F 23 03 D5 FD 7B BC A9 F3 53 01 A9 F5 5B 02 A9 F7 1B 00 F9 FD 03 00 91 ?? ?? ?? ?? FF 43 01 D1 F7 03 00 91 30 00 80 92 F0 1A 00 F9 ?? 03 01 AA ?? 03 02 AA FF ?? 00 F9
99359940
// ----------- PACIBSP, don't scan for this because it's everywhere
99369941
PBYTE match = FindPattern_4_(
@@ -9943,6 +9948,22 @@ static void PatchAppResolver()
99439948
{
99449949
match -= 4;
99459950
}
9951+
else
9952+
{
9953+
// Cobalt
9954+
// 7F 23 03 D5 FD 7B BC A9 F3 53 01 A9 F5 5B 02 A9 F7 1B 00 F9 F9 1F 00 F9 FD 03 00 91 ?? ?? ?? ?? FF 43 01 D1 F7 03 00 91 30 00 80 92 F0 1A 00 F9 ?? 03 01 AA ?? 03 02 AA FF ?? 00 F9
9955+
// ----------- PACIBSP, don't scan for this because it's everywhere
9956+
match = (PBYTE)FindPattern_4_(
9957+
pAppResolverText,
9958+
cbAppResolverText,
9959+
"\xFD\x7B\xBC\xA9\xF3\x53\x01\xA9\xF5\x5B\x02\xA9\xF7\x1B\x00\xF9\xF9\x1F\x00\xF9\xFD\x03\x00\x91\x00\x00\x00\x00\xFF\x43\x01\xD1\xF7\x03\x00\x91\x30\x00\x80\x92\xF0\x1A\x00\xF9\x00\x03\x01\xAA\x00\x03\x02\xAA\xFF\x00\x00\xF9",
9960+
"xxxxxxxxxxxxxxxxxxxxxxxx????xxxxxxxxxxxxxxxx?xxx?xxxx?xx"
9961+
);
9962+
if (match)
9963+
{
9964+
match -= 4;
9965+
}
9966+
}
99469967
#endif
99479968
if (match)
99489969
{
@@ -11990,18 +12011,18 @@ static BOOL StartMenu_FixContextMenuXbfHijackMethod()
1199012011
return FALSE;
1199112012

1199212013
#if defined(_M_X64)
11993-
// 49 89 43 C8 E8 ?? ?? ?? ?? 85 C0
11994-
// ^^^^^^^^^^^
12014+
// 48 8B 45 ?? 49 89 43 C8 E8 ?? ?? ?? ?? 85 C0
12015+
// ^^^^^^^^^^^
1199512016
// Ref: CCoreServices::LoadXamlResource()
1199612017
PBYTE match = FindPattern(
1199712018
pWindowsUIXamlText,
1199812019
cbWindowsUIXamlText,
11999-
"\x49\x89\x43\xC8\xE8\x00\x00\x00\x00\x85\xC0",
12000-
"xxxxx????xx"
12020+
"\x48\x8B\x45\x00\x49\x89\x43\xC8\xE8\x00\x00\x00\x00\x85\xC0",
12021+
"xxx?xxxxx????xx"
1200112022
);
1200212023
if (match)
1200312024
{
12004-
match += 4;
12025+
match += 8;
1200512026
match += 5 + *(int*)(match + 1);
1200612027
}
1200712028
else
@@ -12023,14 +12044,14 @@ static BOOL StartMenu_FixContextMenuXbfHijackMethod()
1202312044
}
1202412045
}
1202512046
#elif defined(_M_ARM64)
12026-
// E1 0B 40 F9 05 00 80 D2 04 00 80 D2 E3 03 ?? AA E2 03 ?? AA E0 03 ?? AA ?? ?? ?? 97
12047+
// E1 0B 40 F9 05 00 80 D2 04 00 80 D2 E3 03 ?? AA E2 03 ?? AA E0 03 ?? AA ?? ?? ?? ?? ?? 03 00 2A
1202712048
// ^^^^^^^^^^^
1202812049
// Ref: CoreServices_TryGetApplicationResource()
1202912050
PBYTE match = FindPattern_4_(
1203012051
pWindowsUIXamlText,
1203112052
cbWindowsUIXamlText,
12032-
"\xE1\x0B\x40\xF9\x05\x00\x80\xD2\x04\x00\x80\xD2\xE3\x03\x00\xAA\xE2\x03\x00\xAA\xE0\x03\x00\xAA\x00\x00\x00\x97",
12033-
"xxxxxxxxxxxxxx?xxx?xxx?x???x"
12053+
"\xE1\x0B\x40\xF9\x05\x00\x80\xD2\x04\x00\x80\xD2\xE3\x03\x00\xAA\xE2\x03\x00\xAA\xE0\x03\x00\xAA\x00\x00\x00\x00\x00\x03\x00\x2A",
12054+
"xxxxxxxxxxxxxx?xxx?xxx?x?????xxx"
1203412055
);
1203512056
if (match)
1203612057
{

0 commit comments

Comments
 (0)